Phantom
Staff Product Security Engineer (Security)
15 ч. назад
Страна неизвестнаSeniorRemoteC1
security engineeringthreat modelingci/cdtypescriptjavascriptrustpythongo
Staff Product Security Engineer responsible for security ownership, architecture review, secure development, tooling, vulnerability management, and incident response for Phantom's products.
Обязанности
- Product Security Ownership: Partner with engineering teams to identify and address security risks across Phantom’s mobile applications, web products, APIs, and backend services
- Architecture and Threat Modeling: Lead security reviews for new products and major architectural changes, with particular attention to authorization boundaries, sensitive data, transaction integrity, key material, and third-party integrations
- Secure Product Development: Embed practical security controls into the software development lifecycle, from design and implementation through testing, release, and production operation
- Code Review and Security Testing: Perform AI assisted security code reviews and targeted testing of high-risk features. Build repeatable approaches that help find vulnerabilities before they reach production
- Security Tooling: Develop and improve tooling that gives engineers fast, actionable security feedback without creating unnecessary friction. Use automation and AI-assisted workflows where they materially improve coverage or speed
- Software Supply Chain Security: Harden CI/CD, build, and release systems against supply chain threats, including dependency risk, secrets exposure, build provenance, artifact integrity, and compromised developer or automation workflows
- Vulnerability Management: Triage findings from internal testing, researchers, bug bounty submissions, and third-party assessments. Work with owners to determine real-world impact and drive issues through verified remediation
- Incident Response: Support the investigation of product security incidents and suspicious activity. Turn lessons from incidents into durable improvements to product architecture, detection, and engineering standards
- Technical Leadership: Establish product security patterns and expectations across engineering. At the Staff level, lead ambiguous, cross-functional initiatives and influence architecture beyond any single product team
Требования
- 5+ years of experience in product security, application security, security engineering, or software engineering, including experience operating at a senior or staff level
- Strong understanding of web, mobile, API, and distributed-system security, including authentication, authorization, session management, cryptography, and common vulnerability classes
- Hands-on experience building or applying AI-assisted security tooling to test applications and APIs, combining automated analysis with source-code review and manual validation
- Demonstrated ability to review production code in one or more languages such as TypeScript, JavaScript, Rust, Python and Go
- Experience securing software supply chains and CI/CD systems, including dependencies, build infrastructure, secrets, artifacts, signing, and release integrity
- Experience threat modeling complex products and translating security risks into concrete engineering requirements
- Strong judgment when evaluating exploitability, business impact, and appropriate remediation
- Track record of partnering effectively with engineering and product teams while maintaining a high security bar
- Clear written and verbal communication, including the ability to explain technical risk to both engineers and non-security stakeholders
Условия
- Формат работы: удалённо